Skip to main content

💼 [RDS.23] RDS instances should not use a database engine default port

  • ID: /frameworks/aws-fsbp-v1.0.0/rds/23

Description​

If you use a known port to deploy an RDS cluster or instance, an attacker can guess information about the cluster or instance. The attacker can use this information in conjunction with other information to connect to an RDS cluster or instance or gain additional information about your application.

When you change the port, you must also update the existing connection strings that were used to connect to the old port. You should also check the security group of the DB instance to ensure that it includes an ingress rule that allows connectivity on the new port.

Similar​

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement326891no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3748no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29452no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services28no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(5) Boundary Protection _ Deny by Default — Allow by Exception418no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic24no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components25no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(21) Boundary Protection _ Isolation of System Components24no data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance

Policies (1)​

PolicyLogic CountFlagsCompliance
🛡️ AWS RDS Instance uses default endpoint port🟢1🟢 x6no data

Internal Rules​

RulePoliciesFlags
✉️ dec-x-fd0bfd1b1